NGINX App Protect (Task B): design spec + the v4 proof box (infra) - #55
Merged
Conversation
The bring-your-own NGINX + App Protect analogue of the BIG-IP Advanced-WAF apply path (bigip_apply.py). Grounded in the actual codebase + an adversarial design review; maps the full L2 spine onto the BIG-IP one: - Transport: SSH → policy file + a copilot-owned managed `include` → nginx -t → reload. v4 (raw JSON) is the v1 target; v4/v5 split lives inside the Nginx client. - New: nginx.py / nginx_lab.py / nginx_apply.py (mirror bigip.py / bigip_lab.py / bigip_apply.py). Reuses emit(target='nginx-app-protect'), _run_validation, probe_from_spec, ledger, audit unchanged. One new control string: nginx_app_protect. - All three forms port (service_policy / waf_data_guard / api_schema); waf stays honestly DECLINED (NAP's own signature staging — the exact BIG-IP analogue). - §10 "Verify on the live box" collects every NAP runtime behavior asserted from schema+docs but unproven (entity staging, block-page text, the reload/enforcer command, v4/v5, uncited identifiers). The live L2 proof is the tiebreaker, same discipline as the three BIG-IP forms; nothing unsafe can ship (the live probe fails closed on all of them). - §11 provisioning plan: no NAP box exists yet, so standing one up (NGINX Plus + App Protect v4 EC2, reuse the lab VPC + Larkspur origin, JWT install out-of-band) is the first step. Design only — no code yet. Follows the docs/design/bigip-apply.md precedent (#46). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
henleda
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task B kickoff for the bring-your-own NGINX + App Protect variant: the design spec and the Terraform for the proof box to validate it on. Two commits, both reviewable independently.
1. Design spec —
docs/design/nginx-app-protect-apply.mdThe L2 analogue of
bigip_apply.py, from a research + design + adversarial-critique pass grounded in the actual codebase. Follows thedocs/design/bigip-apply.mdprecedent (#46).include→nginx -t→ reload. Newnginx.py/nginx_lab.py/nginx_apply.pymirror thebigip.pytrio;emit(target='nginx-app-protect'),_run_validation,probe,ledger,auditreused unchanged. One new control string:nginx_app_protect. v4 (raw JSON) is the v1 target.wafstays honestly DECLINED (NAP's own signature staging — the exact BIG-IP analogue).2. Proof box —
infra/vpcopilot-nap/A single NGINX Plus + App Protect v4 EC2 that fronts the existing Larkspur origin, so we can prove a form end-to-end on a real NAP box.
vpcopilot-labVPC + subnet (data-sourced by tag) + the running Larkspur origin. The lab's origin SG already admits:8080from the VPC CIDR → adds one box, zero changes tovpcopilot-lab.terraform plan: 7 to add, 0 to change, 0 to destroy (validated against the live lab VPCvpc-034a04318ab240063).t3.mediumat10.30.10.30, public EIP, SG (vhost:80; SSH via SSM), SSM role, keypair from.secrets/.make onboard JWT=…): installs NGINX Plus + App Protect using the F5 subscription JWT, stands up a reverse-proxy vhost to Larkspur with App Protect enforcing, ends with a smoke test. The JWT lands only at/etc/nginx/license.jwton the box — never inuser_dataor state. Secrets/state/*.jwtgitignored.# VERIFY:markers (repo-auth line, package names, log path) — the NAP Phase-0 live spike, expected to iterate on first contact like the BIG-IP onboarding did.Provisioning stays user-gated —
terraform applyis yours to run.Next (once merged / on your go)
make apply→make onboard(with the JWT) → prove the NAP install blocks → resolve the §10 must-fixes on the real box → build outnginx_apply.py+ the forms.🤖 Generated with Claude Code